Off-Brand H96 Android TV Boxes Tied to Ad Fraud and Residential Proxy Botnet

BitSight TRACE reported that off-brand H96 Android TV streaming boxes were used in a large ad-fraud and residential-proxy operation linked to Zhejiang Fengwo IoT Technology Co., Ltd., also known as Fengwo Group. Researcher Pedro Falé gained visibility into the activity by registering an expired domain previously used by the devices for telemetry, exposing tens of thousands of boxes that spoofed themselves as mobile phones from brands including Samsung, Vivo, Huawei, and Xiaomi. The devices allegedly ran two Fengwo-linked apps that coordinated fake ad clicks against AI-generated websites built to serve ads only to the spoofed mobile identities.

BitSight estimated that about 38,000 devices were contacting one observed Fengwo domain and that the ad-fraud component alone could produce nearly $50,000 per day, not including revenue from proxy services. The report also described the broader Fuyao Enterprise as an Android TV botnet supporting ad fraud at scale, with references to more than 120,000 AI digital humans used in the scheme. Researchers said the boxes switched roles depending on use, acting as residential proxies while the TV was on and performing ad-fraud tasks while it was off, underscoring the privacy, botnet, and supply-chain risks posed by insecure generic streaming devices.